Bypass MFA for specific users or groups - NPS Extension for Azure MFA

Mohit Pathak 25

We're utilizing NPS Extension for Azure MFA in our Highly available RDS Environment (Two RDGW Machines, Two NPS Machines (with extension installed), and Two connection broker machines))

We have a requirement to exclude service accounts from getting MFA prompts when they're utilized while establishing an RDP connection. Already Tried the conditional access policy approach, But that doesn't work with the RDP connection

Please suggest a solution that we can implement

2 answers

Raja Pothuraju 6,170 Reputation points Microsoft Vendor

2024-06-04T06:14:33.1633333+00:00

Hello @Mohit Pathak,

Thank you for posting your query on Microsoft Q&A.

To exclude service accounts from getting MFA prompts when they're utilized while establishing an RDP connection, you can add the following registry setting under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AzureMfa:

Value Name: REQUIRE_USER_MATCH Value Type: REG_SZ Value Data: FALSE

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AzureMfa | REQUIRE_USER_MATCH | REG_SZ | FALSE

Adding this value and setting it to FALSE allows the NPS extension to bypass secondary authentication failures for Non-MFA Enrolled users. Setting REQUIRE_USER_MATCH=FALSE skips the enrollment check which allows non-MFA Enrolled users to authenticate using Primary authentication only. This should allow service accounts to bypass MFA prompts when establishing an RDP connection.

Please refer below article for more information.
https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-nps-extension#prepare-for-users-that-arent-enrolled-for-mfa

I hope this information is helpful. Please feel free to reach out if you have any further questions.

Thanks,
Raja Pothuraju.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Please sign in to rate this answer.
Mohit Pathak 25 Reputation points

2024-06-05T05:41:20.59+00:00

Hello Raja,

My requirement is a bit different. These service accounts are MFA-Enrolled indeed

But I want MFA not to be triggered when someone logs via RDP using these accounts. Hence, Checking to see if there is a way to exclude users from MFA prompt maybe at Gateway servers or NPS servers level via Policy or somewhere else.

You seem knowledgable on this, I will be waiting for your input.

Raja Pothuraju 6,170 Reputation points Microsoft Vendor

2024-06-11T11:18:02.5133333+00:00

Hello @Mohit Pathak,

Thank you for following up on this!

From the perspective of the NPS extension for Azure MFA, the workaround mentioned above appears to be the only option to meet your requirement. I agree with you that changing the registry setting will only affect users who are not enrolled in MFA, and you can't use it as intended as your service accounts are MFA-Enrolled.

if there is a way to exclude users from MFA prompt maybe at Gateway servers or NPS servers level via Policy or somewhere else.

To make it possible from RDGW server end, I referred to a third-party public documentation that discusses bypassing MFA for certain users when they log in via RDP. You can find the blog post here:

https://www.starwindsoftware.com/blog/exclude-users-with-vpn-or-remote-desktop-gateway-access-from-nps-extension-for-azure-mfa

Please note: Since this isn't an official Microsoft document, I suggest implementing these steps first in your test environment. Based on the observed results, you can then decide whether to proceed with it in the production environment.

I hope this information is helpful. Please feel free to reach out if you have any further questions.

Thanks,

Raja Pothuraju.

Raja Pothuraju 6,170 Reputation points Microsoft Vendor

2024-06-14T18:48:40.8733333+00:00

Hello @Mohit Pathak,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Raja Pothuraju 6,170 Reputation points Microsoft Vendor

2024-06-17T07:34:03.3366667+00:00

Hello @Mohit Pathak,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Wai-Kit Leung 0 Reputation points

2024-09-30T14:56:07.9933333+00:00

Hi,

We have a similar issue, when a users sign into the the Azure VM using RDP, open any office program, need to authenticate with user credentials, followed by 3 MFA prompts/challenge inputting a code, followed by some thing went wrong 8018001C error code.

Once the press "Done" the user is able to use office apps for the next 5 days before they have to reauthenticate again.

Thanks,
Wai-Kit
Please sign in to rate this answer.
Raja Pothuraju 6,170 Reputation points Microsoft Vendor

2024-09-30T22:24:05.5+00:00

Hello @Wai-Kit Leung,

I pinged over teams, please check. Let's take this offline to troubleshoot the issue.

Thanks,
Raja Pothuraju.

Wai-Kit Leung 0 Reputation points

2024-10-01T08:00:18.46+00:00

Hi Raja,

I've replied back to you on Teams.

Thanks,

Wai-Kit

Raja Pothuraju 6,170 Reputation points Microsoft Vendor

2024-10-01T22:02:05.07+00:00

Hello @Wai-Kit Leung,

Thank you for your time over the team's call.

As we discussed, the issue might be due to the device not being enrolled in Entra. Since the device is domain-joined with your on-premises Active Directory, it requires the setup of an SCP (Service Connection Point) configuration via Entra Connect to sync the device with Entra. From the Event Viewer, we observed the error code 0x801c001d, which indicates that the device is unable to read the SCP object and retrieve the Microsoft Entra tenant information. Please refer to the Configure a service connection point section.

Discover phase

Refer to the document we discussed below, and feel free to reach out if you need further assistance:

Configure Microsoft Entra hybrid join

Thanks,
Raja Pothuraju.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Bypass MFA for specific users or groups - NPS Extension for Azure MFA

2 answers

Your answer